brakeman 3.7.2 → 5.4.1

data/lib/brakeman/processors/slim_template_processor.rb

@@ -8,6 +8,7 @@ class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
   OUTPUT_BUFFER = s(:ivar, :@output_buffer)
   TEMPLE_UTILS = s(:colon2, s(:colon3, :Temple), :Utils)
   ATTR_MERGE = s(:call, s(:call, s(:array), :reject, s(:block_pass, s(:lit, :empty?))), :join, s(:str, " "))
+  EMBEDDED_FILTER = s(:const, :BrakemanFilter)
 
   def process_call exp
     target = exp.target
@@ -44,6 +45,21 @@ class Brakeman::SlimTemplateProcessor < Brakeman::TemplateProcessor
     end
   end
 
+  def normalize_output arg
+    arg = super(arg)
+
+    if embedded_filter? arg
+      super(arg.first_arg)
+    else
+      arg
+    end
+  end
+
+  # Handle our "fake" embedded filters
+  def embedded_filter? arg
+    call? arg and arg.method == :render and arg.target == EMBEDDED_FILTER
+  end
+
   #Slim likes to interpolate output into strings then pass them to safe_concat.
   #Better to pull those values out directly.
   def process_inside_interp exp

data/lib/brakeman/processors/template_alias_processor.rb

@@ -14,12 +14,16 @@ class Brakeman::TemplateAliasProcessor < Brakeman::AliasProcessor
   def initialize tracker, template, called_from = nil
     super tracker
     @template = template
+    @current_file = template.file
     @called_from = called_from
   end
 
   #Process template
-  def process_template name, args, _, line = nil, file_name = nil
-    @file_name = file_name || relative_path(@template.file || @tracker.templates[@template.name])
+  def process_template name, args, _, line = nil
+    # Strip forward slash from beginning of template path.
+    # This also happens in RenderHelper#process_template but
+    # we need it here too to accurately avoid circular renders below.
+    name = name.to_s.gsub(/^\//, "")
 
     if @called_from
       if @called_from.include_template? name
@@ -27,12 +31,40 @@ class Brakeman::TemplateAliasProcessor < Brakeman::AliasProcessor
         return
       end
 
-      super name, args, @called_from.dup.add_template_render(@template.name, line, @file_name)
+      super name, args, @called_from.dup.add_template_render(@template.name, line, @current_file), line
     else
-      super name, args, Brakeman::RenderPath.new.add_template_render(@template.name, line, @file_name)
+      super name, args, Brakeman::RenderPath.new.add_template_render(@template.name, line, @current_file), line
     end
   end
 
+  def process_lasgn exp
+    if exp.lhs == :haml_temp or haml_capture? exp.rhs
+      exp.rhs = process exp.rhs
+
+      # Avoid propagating contents of block
+      if node_type? exp.rhs, :iter
+        new_exp = exp.dup
+        new_exp.rhs = exp.rhs.block_call
+
+        super new_exp
+
+        exp # Still save the original, though
+      else
+        super exp
+      end
+    else
+      super exp
+    end
+  end
+
+  HAML_CAPTURE = [:capture, :capture_haml]
+
+  def haml_capture? exp
+    node_type? exp, :iter and
+      call? exp.block_call and
+      HAML_CAPTURE.include? exp.block_call.method
+  end
+
   #Determine template name
   def template_name name
     if !name.to_s.include?('/') && @template.name.to_s.include?('/')

data/lib/brakeman/processors/template_processor.rb

@@ -5,10 +5,10 @@ require 'brakeman/tracker/template'
 class Brakeman::TemplateProcessor < Brakeman::BaseProcessor
 
   #Initializes template information.
-  def initialize tracker, template_name, called_from = nil, file_name = nil
-    super(tracker) 
-    @current_template = Brakeman::Template.new template_name, called_from, file_name, tracker
-    @file_name = file_name
+  def initialize tracker, template_name, called_from = nil, current_file = nil
+    super(tracker)
+    @current_template = Brakeman::Template.new template_name, called_from, current_file, tracker
+    @current_file = @current_template.file
 
     if called_from
       template_name = (template_name.to_s + "." + called_from.to_s).to_sym
@@ -61,9 +61,9 @@ class Brakeman::TemplateProcessor < Brakeman::BaseProcessor
       branches = [arg.then_clause, arg.else_clause].compact
 
       if branches.empty?
-        s(:nil)
+        s(:nil).line(arg.line)
       elsif branches.length == 2
-        Sexp.new(:or, *branches)
+        Sexp.new(:or, *branches).line(arg.line)
       else
         branches.first
       end
@@ -77,9 +77,13 @@ class Brakeman::TemplateProcessor < Brakeman::BaseProcessor
   end
 
   def add_output output, type = :output
-    s = Sexp.new(type, output)
-    s.line(output.line)
-    @current_template.add_output s
-    s
+    if node_type? output, :or
+      Sexp.new(:or, add_output(output.lhs, type), add_output(output.rhs, type)).line(output.line)
+    else
+      s = Sexp.new(type, output)
+      s.line(output.line)
+      @current_template.add_output s
+      s
+    end
   end
 end

data/lib/brakeman/report/ignore/config.rb

@@ -22,6 +22,7 @@ module Brakeman
     def filter_ignored
       @shown_warnings = []
       @ignored_warnings = []
+      @used_fingerprints = Set.new
 
       @new_warnings.each do |w|
         if ignored? w
@@ -93,10 +94,18 @@ module Brakeman
       end
     end
 
+    def already_ignored_entries_with_empty_notes
+      @already_ignored.select { |i| i if i[:note].strip.empty? }
+    end
+
     # Read configuration to file
     def read_from_file file = @file
       if File.exist? file
-        @already_ignored = JSON.parse(File.read(file), :symbolize_names => true)[:ignored_warnings]
+        begin
+          @already_ignored = JSON.parse(File.read(file), :symbolize_names => true)[:ignored_warnings]
+        rescue => e
+          raise e, "\nError[#{e.class}] while reading brakeman ignore file: #{file}\n"
+        end
       else
         Brakeman.notify "[Notice] Could not find ignore configuration in #{file}"
         @already_ignored = []
@@ -112,14 +121,12 @@ module Brakeman
     def save_to_file warnings, file = @file
       warnings = warnings.map do |w|
         if w.is_a? Warning
-          w_hash = w.to_hash
-          w_hash[:file] = w.relative_path
-          w = w_hash
+          w = w.to_hash(absolute_paths: false)
         end
 
         w[:note] = @notes[w[:fingerprint]] || ""
         w
-      end.sort_by { |w| w[:fingerprint] }
+      end.sort_by { |w| [w[:fingerprint], w[:line] || 0] }
 
       output = {
         :ignored_warnings => warnings,

data/lib/brakeman/report/ignore/interactive.rb

@@ -62,7 +62,7 @@ module Brakeman
           process_warnings
         end
 
-        m.choice "Hide previously ignored warnings" do
+        m.choice "Inspect new warnings" do
           @skip_ignored = true
           pre_show_help
           process_warnings
@@ -88,10 +88,10 @@ module Brakeman
 
         m.choice "i"
         m.choice "n"
-        m.choice "k"
+        m.choice "s"
         m.choice "u"
         m.choice "a"
-        m.choice "s"
+        m.choice "k"
         m.choice "q"
         m.choice "?" do
           show_help
@@ -280,9 +280,9 @@ q - Quit, do not update ignored warnings
         say warning.format_code
       end
 
-      if warning.relative_path
+      if warning.file
         label "File"
-        say warning.relative_path
+        say warning.file.relative
       end
 
       if warning.line

data/lib/brakeman/report/pager.rb

@@ -0,0 +1,113 @@
+module Brakeman
+  class Pager
+    def initialize tracker, pager = :less, output = $stdout
+      @tracker = tracker
+      @pager = pager
+      @output = output
+      @less_available = @less_options = nil
+    end
+
+    def page_report report, format
+      if @pager == :less
+        set_color
+      end
+
+      text = report.format(format)
+
+      if in_ci?
+        no_pager text
+      else
+        page_output text
+      end
+    end
+
+    def page_output text
+      case @pager
+      when :none
+        no_pager text
+      when :highline
+        page_via_highline text
+      when :less
+        if less_available?
+          page_via_less text
+        else
+          page_via_highline text
+        end
+      else
+        no_pager text
+      end
+    end
+
+    def no_pager text
+      @output.puts text
+    end
+
+    def page_via_highline text
+      Brakeman.load_brakeman_dependency 'highline'
+      h = ::HighLine.new($stdin, @output)
+      h.page_at = :auto
+      h.say text
+    end
+
+    def page_via_less text
+      # Adapted from https://github.com/piotrmurach/tty-pager/
+
+      write_io = open("|less #{less_options.join}", 'w')
+      pid = write_io.pid
+
+      write_io.write(text)
+      write_io.close
+
+      Process.waitpid2(pid, Process::WNOHANG)
+    rescue Errno::ECHILD
+      # on jruby 9x waiting on pid raises (per tty-pager)
+      true
+    rescue => e
+      warn "[Error] #{e}"
+      warn "[Error] Could not use pager. Set --no-pager to avoid this issue."
+      no_pager text
+    end
+
+    def in_ci?
+      ci = ENV["CI"]
+
+      ci.is_a? String and ci.downcase == "true"
+    end
+
+    def less_available?
+      return @less_available unless @less_available.nil?
+
+      @less_available = system("which less > /dev/null")
+    end
+
+    def less_options
+      # -R show colors
+      # -F exit if output fits on one screen
+      # -X do not clear screen after less exits
+
+      return @less_options if @less_options
+
+      @less_options = []
+
+      if system("which less > /dev/null")
+        less_help = `less -?`
+
+        ["-R ", "-F ", "-X "].each do |opt|
+          if less_help.include? opt
+            @less_options << opt
+          end
+        end
+      end
+
+      @less_options
+    end
+
+    def set_color
+      return unless @tracker
+
+      unless less_options.include? "-R " or @tracker.options[:output_color] == :force
+        @tracker.options[:output_color] = false
+      end
+    end
+  end
+end

data/lib/brakeman/report/report_base.rb

@@ -3,6 +3,7 @@ require 'brakeman/util'
 require 'brakeman/version'
 require 'brakeman/report/renderer'
 require 'brakeman/processors/output_processor'
+require 'brakeman/warning'
 
 # Base class for report formats
 class Brakeman::Report::Base
@@ -10,10 +11,8 @@ class Brakeman::Report::Base
 
   attr_reader :tracker, :checks
 
-  TEXT_CONFIDENCE = [ "High", "Medium", "Weak" ]
-
-  def initialize app_tree, tracker
-    @app_tree = app_tree
+  def initialize tracker
+    @app_tree = tracker.app_tree
     @tracker = tracker
     @checks = tracker.checks
     @ignore_filter = tracker.ignored_filter
@@ -21,18 +20,25 @@ class Brakeman::Report::Base
     @warnings_summary = nil
   end
 
-  #Generate table of how many warnings of each warning type were reported
-  def generate_warning_overview
-    types = warnings_summary.keys
-    types.delete :high_confidence
-    values = types.sort.collect{|warning_type| [warning_type, warnings_summary[warning_type]] }
-    locals = {:types => types, :warnings_summary => warnings_summary}
+  #Return summary of warnings in hash and store in @warnings_summary
+  def warnings_summary
+    return @warnings_summary if @warnings_summary
+
+    summary = Hash.new(0)
+    high_confidence_warnings = 0
 
-    render_array('warning_overview', ['Warning Type', 'Total'], values, locals)
+    [all_warnings].each do |warnings|
+      warnings.each do |warning|
+        summary[warning.warning_type.to_s] += 1
+        high_confidence_warnings += 1 if warning.confidence == 0
+      end
+    end
+
+    summary[:high_confidence] = high_confidence_warnings
+    @warnings_summary = summary
   end
 
-  #Generate table of controllers and routes found for those controllers
-  def generate_controllers
+  def controller_information
     controller_rows = []
 
     tracker.controllers.keys.map{|k| k.to_s}.sort.each do |name|
@@ -66,148 +72,7 @@ class Brakeman::Report::Base
       }
     end
 
-    cols = ['Name', 'Parent', 'Includes', 'Routes']
-
-    locals = {:controller_rows => controller_rows}
-    values = controller_rows.collect{|row| row.values_at(*cols) }
-    render_array('controller_overview', cols, values, locals)
-  end
-
-  #Generate table of errors or return nil if no errors
-  def generate_errors
-    values = tracker.errors.collect{|error| [error[:error], error[:backtrace][0]]}
-    render_array('error_overview', ['Error', 'Location'], values, {:tracker => tracker})
-  end
-
-  def generate_obsolete
-    values = tracker.unused_fingerprints.collect{|fingerprint| [fingerprint] }
-    render_array('obsolete_ignore_entries', ['fingerprint'], values, {:tracker => tracker})
-  end
-
-  def generate_warnings
-    render_warnings generic_warnings,
-                    :warning,
-                    'security_warnings',
-                    ["Confidence", "Class", "Method", "Warning Type", "Message"],
-                    'Class'
-  end
-
-  #Generate table of template warnings or return nil if no warnings
-  def generate_template_warnings
-    render_warnings template_warnings,
-                    :template,
-                    'view_warnings',
-                    ['Confidence', 'Template', 'Warning Type', 'Message'],
-                    'Template'
-
-  end
-
-  #Generate table of model warnings or return nil if no warnings
-  def generate_model_warnings
-    render_warnings model_warnings,
-                    :model,
-                    'model_warnings',
-                    ['Confidence', 'Model', 'Warning Type', 'Message'],
-                    'Model'
-  end
-
-  #Generate table of controller warnings or nil if no warnings
-  def generate_controller_warnings
-    render_warnings controller_warnings,
-                    :controller,
-                    'controller_warnings',
-                    ['Confidence', 'Controller', 'Warning Type', 'Message'],
-                    'Controller'
-  end
-
-  def generate_ignored_warnings
-    render_warnings ignored_warnings,
-                    :ignored,
-                    'ignored_warnings',
-                    ['Confidence', 'Warning Type', 'File', 'Message'],
-                    'Warning Type'
-  end
-
-  def render_warnings warnings, type, template, cols, sort_col
-    unless warnings.empty?
-      rows = sort(convert_to_rows(warnings, type), sort_col)
-
-      values = rows.collect { |row| row.values_at(*cols) }
-
-      locals = { :warnings => rows }
-
-      render_array(template, cols, values, locals)
-    else
-      nil
-    end
-  end
-
-  def convert_to_rows warnings, type = :warning
-    warnings.map do |warning|
-      w = warning.to_row type
-
-      case type
-      when :warning
-        convert_warning w, warning
-      when :template
-        convert_template_warning w, warning
-      when :model
-        convert_model_warning w, warning
-      when :controller
-        convert_controller_warning w, warning
-      when :ignored
-        convert_ignored_warning w, warning
-      end
-    end
-  end
-
-  def convert_warning warning, original
-    warning["Confidence"] = TEXT_CONFIDENCE[warning["Confidence"]]
-    warning["Message"] = text_message original, warning["Message"]
-    warning
-  end
-
-  def convert_template_warning warning, original
-    convert_warning warning, original
-  end
-
-  def convert_model_warning warning, original
-    convert_warning warning, original
-  end
-
-  def convert_controller_warning warning, original
-    convert_warning warning, original
-  end
-
-  def convert_ignored_warning warning, original
-    convert_warning warning, original
-  end
-
-  def sort rows, sort_col
-    stabilizer = 0
-    rows.sort_by do |row|
-      stabilizer += 1
-
-      row.values_at("Confidence", "Warning Type", sort_col) << stabilizer
-    end
-  end
-
-  #Return summary of warnings in hash and store in @warnings_summary
-  def warnings_summary
-    return @warnings_summary if @warnings_summary
-
-    summary = Hash.new(0)
-    high_confidence_warnings = 0
-
-    [all_warnings].each do |warnings|
-      warnings.each do |warning|
-        summary[warning.warning_type.to_s] += 1
-        high_confidence_warnings += 1 if warning.confidence == 0
-      end
-    end
-
-    summary[:high_confidence] = high_confidence_warnings
-    @warnings_summary = summary
+    controller_rows
   end
 
   def all_warnings
@@ -256,14 +121,50 @@ class Brakeman::Report::Base
     Set.new(tracker.templates.map {|k,v| v.name.to_s[/[^.]+/]}).length
   end
 
-  def warning_file warning, absolute = @tracker.options[:absolute_paths]
+  def absolute_paths?
+    @tracker.options[:absolute_paths]
+  end
+
+  def warning_file warning
     return nil if warning.file.nil?
 
-    if absolute
-      warning.file
+    if absolute_paths?
+      warning.file.absolute
     else
-      relative_path warning.file
+      warning.file.relative
+    end
+  end
+
+  #Return array of lines surrounding the warning location from the original
+  #file.
+  def context_for warning
+    file = warning.file
+    context = []
+    return context unless warning.line and file and file.exists?
+
+    current_line = 0
+    start_line = warning.line - 5
+    end_line = warning.line + 5
+
+    start_line = 1 if start_line < 0
+
+    File.open file do |f|
+      f.each_line do |line|
+        current_line += 1
+
+        next if line.strip == ""
+
+        if current_line > end_line
+          break
+        end
+
+        if current_line >= start_line
+          context << [current_line, line]
+        end
+      end
     end
+
+    context
   end
 
   def rails_version
@@ -279,13 +180,12 @@ class Brakeman::Report::Base
     end
   end
 
-  #Escape warning message and highlight user input in text output
-  def text_message warning, message
-    if @highlight_user_input and warning.user_input
-      user_input = warning.format_user_input
-      message.gsub(user_input, "+#{user_input}+")
+  def github_url file, line=nil
+    if repo_url = @tracker.options[:github_url] and file
+      url = "#{repo_url}/#{file.relative}"
+      url << "#L#{line}" if line
     else
-      message
+      nil
     end
   end
 end

data/lib/brakeman/report/report_codeclimate.rb

@@ -1,5 +1,6 @@
 require "json"
 require "yaml"
+require "pathname"
 
 class Brakeman::Report::CodeClimate < Brakeman::Report::Base
   DOCUMENTATION_PATH = File.expand_path("../../../../docs/warning_types", __FILE__)
@@ -24,7 +25,7 @@ class Brakeman::Report::CodeClimate < Brakeman::Report::Base
       severity: severity_level_for(warning.confidence),
       remediation_points: remediation_points_for(warning_code_name),
       location: {
-        path: warning.relative_path,
+        path: file_path(warning),
         lines: {
           begin: warning.line || 1,
           end: warning.line || 1,
@@ -67,4 +68,12 @@ class Brakeman::Report::CodeClimate < Brakeman::Report::Base
 
     File.read(filename) if File.exist?(filename)
   end
+
+  def file_path(warning)
+    if tracker.options[:path_prefix]
+      (Pathname.new(tracker.options[:path_prefix]) + Pathname.new(warning.file.relative)).to_s
+    else
+      warning.relative_path
+    end
+  end
 end